Email templates as content: reusable subject, body and layout, with preview

Arnel asked how email templates are built with barakoBrew and barakoCMS. Today they are not a thing of their own: an Email workflow action carries `To`, `Subject` and `Body` as strings with placeholders, typed into that one workflow. Two workflows sending the same message each hold a copy, there is no layout, no preview and no way for a non-developer to reword a message without opening the workflow.

## Change

- **Templates are content.** A built-in `emailTemplate` blueprint: `Name`, `Subject`, `Body` (markdown), `Layout` (a reference to an `emailLayout` entry holding the header, footer, logo and colours, defaulting to the tenant's site settings from #793), `Locale`. Not publicly deliverable.
- **The Email action takes a template.** `Parameters: { "Template": "", "To": "{{createdBy.email}}" }`, with `Subject` and `Body` still accepted as today for existing workflows. Placeholders in the template resolve against the entry that triggered the workflow (#805 and the formats issue).
- **Rendering.** Markdown to HTML with a plain text part, the layout wrapped around it, every placeholder value HTML encoded, links only http, https and mailto.
- **Preview.** `POST /api/email-templates/{id}/preview` with an entry id renders subject and body without sending, gated by `manage_workflows`.
- **Test send.** The same with `send: true` to the caller's own address only.

## Done when

- A template used by two workflows is reworded once and both send the new text.
- A placeholder value containing `` arrives escaped in the HTML part.
- An existing workflow with `Subject` and `Body` sends exactly as before.

## Where it lives

Core: the `Email` action lives in `Features/Workflows/Actions`, so the `Template` parameter, rendering and preview are core, and the `emailTemplate` and `emailLayout` types ship as a built-in blueprint. Sending stays with the Email modules through the core's email provider interface.

Start in Features/Workflows/Actions by reading the existing Email action and how its Subject and Body parameters are handled. Trace the core email provider interface and the built-in blueprint location for emailTemplate and emailLayout. Done means shared templates render safely, preview and test-send are gated, and existing workflows still send exactly as before.

Written by the indexing model from the issue text.